GHSA-P538-C434-8V24: Arbitrary File Truncation via Argument Injection in GitPython Commit.count

Vulnerability ID: GHSA-P538-C434-8V24
CVSS Score: 7.5
Published: 2026-08-03

GitPython prior to version 3.1.56 is vulnerable to argument injection in the Commit.count method. An attacker who controls keyword arguments passed to this method can inject arbitrary Git options, such as --output, leading to arbitrary file truncation on the host filesystem.

TL;DR

Unsafe forwarding of keyword arguments in GitPython's Commit.count method allows remote attackers to inject command-line flags like --output, causing arbitrary files on the local filesystem to be truncated to zero bytes.

Technical Details

• CWE ID: CWE-88 (Improper Control of Generation of Code / Argument Injection)
• Attack Vector: Local/Remote parameter injection
• CVSS Score: 7.5 (High)
• EPSS Score: N/A
• Impact: Arbitrary File Truncation
• Exploit Status: PoC Available
• KEV Status: Not Listed

Affected Systems

• GitPython
• GitPython: < 3.1.56 (Fixed in: 3.1.56)

Code Analysis

Commit: 38553b6

Prevent unsafe options in Commit.count

Mitigation Strategies

• Upgrade GitPython to version 3.1.56 or later.
• Sanitize dictionary keys before unpacking them as keyword arguments into Commit.count.
• Employ the principle of least privilege to run applications wrapping Git binaries.

Remediation Steps:

1. Identify all code locations using GitPython's Commit.count method.
2. Update requirements.txt, setup.py, or Pipfile to pin GitPython>=3.1.56.
3. Verify that user inputs are not directly passed to dynamic keyword parameters in library calls.

References

• Official GitHub Advisory
• Official GitPython Pull Request
• Official Patch Commit
• Official Release Notes

Read the full report for GHSA-P538-C434-8V24 on our website for more details including interactive diagrams and full exploit analysis.